Token Types

The Portal has three types of tokens

• global
• batch (Deprecated)
• user (Deprecated)
• master (Deprecated)

Deprecation Notice

In Q2.2020 user, master and batch tokens will be deprecated. All new developments are required to use the global token and existing deployments will accordingly need to plan a migration. The migration to the global tokens assumes that Portal will drop support for RPS identifiers, which grouped cross listed vendors (also known as a physical restaurant).

Currently the global token only contains vendor identifiers: Global Entity ID and vendor ID. If the plugin depends on user information, such that is already available in the user and master tokens, please communicate it to the Portal team so the exposing of user information in the global token can be prioritised.

By the end of Q2.2020 RPS plans to decomission its legacy "icash" system and additionally Portal is decoupling itself from RPS. To do so successfully requires removing the hard dependency on RPS identifiers.

Global token

The global token contains a map of vendor codes per Global Entity ID and basic user information. No proprietary RPS identifiers. All vendors are available in the token.

History

Portal can support chain users with more than 200 vendors. The reduced size of the global token allow authorization headers to contain more information about the user.

Token body

{
    "country": "de",
    "version": "1",
    "impersonator": false,
    "user": {
        "locale": "en",
        "name": "Alexey",
        "email": "[email protected]"
    },
    "vendors": {
        "FO_FI": [
            "s2sl0",
            "s2sl1"
        ],
        "FP_MY": [
            "s2sl2",
            "s2sl3"
        ]
    },
    "iat": 1580915044,
    "exp": 1580915344,
    "aud": "global",
    "iss": "portalAuth",
    "sub": "eu-12"
}

Batch token

The batch token is "Platform Vendor" optimised. It contains a list of tupils containing the Global Entity ID and the vendor code. No proprietary RPS identifiers. All vendors are available in the token.

History

Plugin teams can perform changes on multiple vendors in a single request. Thus allowing for "batch" operations.

Token Body

{
  "authSchema": [
    [
      "FO_NO",
      "n7vc"
    ],
    [
      "FO_NO",
      "n3ca"
    ],
    [
      "FO_NO",
      "n9on"
    ]
  ],
  "iat": 1580915044,
  "exp": 1580915344,
  "aud": "batch",
  "iss": "portalAuth",
  "sub": "1"
}

Global token

The default token when using createGlobalApi factory. Designed for representing all vendors the user has access to.

History

The first token ever issued by the Portal. Is consists of an authSchema with a single "physical restaurant" and the appropriately attached vendor platforms.

Token Body

{
  "country": "OM",
  "user": {
    "locale": "en",
    "name": "Max Mustermann",
    "email": "[email protected]",
    "userId": "1247",
    "operatorCode": "master-1247"
  },
  "version": "1",
  "authSchema": {
    "restaurants": [
      {
        "id": "125562",
        "platforms": [
          {
            "restaurantId": "33460",
            "platformId": "TB_OM",
            "platformKey": "TB"
          }
        ]
      }
    ]
  },
  "iat": 1580910761,
  "exp": 1580914361,
  "aud": "user",
  "iss": "portalAuth",
  "sub": "1"
}

Master token

An optimised "user" token only containing the user dictionary and a list of RPS of identifiers in the authSchema.

History

Chain users: A single user, aka chain or master user, that has access to multiple physical restaurants. The original token included additional claims that were not required and added to the weight of the token. Thus the master token is optimised to only include RPS identifiers.

Token Body

{
  "country": "OM",
  "user": {
    "locale": "en",
    "name": "Max Mustermann",
    "email": "[email protected]",
    "userId": "1249",
    "operatorCode": ""
  },
  "version": "2",
  "authSchema": {
    "restaurants": [
      {
        "id": "125562"
      }
    ]
  },
  "iat": 1580910756,
  "exp": 1580914356,
  "aud": "master",
  "iss": "portalAuth",
  "sub": "1"
}

Auth Schema